Authentication

Use the documented sign-up and login flows, then send the returned bearer token in the Authorization header. The current API surface exposes /api/signup, /api/login, /api/logout, and /api/me; verify exact request and response details in the Authentication and identity reference and API guides.

Do not assume refresh-token, SDK, webhook, or alternate authentication behavior unless it is present in the current OpenAPI document. A missing, invalid, or expired credential is an authentication failure; a valid credential without the required organization capability is an authorization failure.

Treat tokens as secrets. Never commit them or place them in support tickets.